CHANGELOG.md

Changelog

What changed in OpenVibe.MediaHub, newest first. Each site also publishes its patch notes at /updates.

Unreleased

• A recording's picture-in-picture plays in sync with it (2026-11-13, Maticus: "the robot PiP freezes on VODs"). The
  streams a Live recording drew over itself now each plays its own VOD over the watch page: while the main video is
  inside a span the PiP is at offset + (main - from), outside it the PiP hides. It follows the main's play, pause,
  seeks and speed (a seek on one seeks the other, a wait on either pauses both), drift over 0.3 s is nudged with a
  playbackRate factor between 0.95 and 1.05, and over 2 s seeks. The box is openvibe-shared's OVFloat (drag, tuck,
  pinch/grip size, its place kept per device); a tap (or Enter) swaps it with the main view, sources and times both
  ways. Several spans work, and a span whose PiP VOD is gone hides with one quiet line. The server keeps those
  missing spans in vod.pips (missing: true) and gives each its vod_id. Tests: test/vod-pip-core.test.js (the
  time mapping and the drift decision), test/vod-pip-chrome.test.js (two local videos: seeks on the main move the
  PiP, pause/rate/drift follow, a tap swaps) and test/video-pips.test.js (the page hands the player each span).

• openvibe.pics' home icons and "Choose a picture" (2026-11-13, the owner's phone). The "What you get", "The links a
  picture gets" and "What we promise, in writing" cards gave the shared showcase bare glyph names, which it drew as
  Font Awesome placeholders with no font and no mapping: every icon was an empty 40 px square. They are now the glyph
  registry's SVG, drawn on the server. The upload button lost its pink to the shared presence sheet's later .ovp-btn
  rule, leaving near-black text on the dark card; Pics' buttons are scoped to .ovp-page, 44 px tall, and the label
  carries the upload glyph. Tests: test/pics.test.js checks every feature icon is inline SVG, and
  test/pics-browser.test.js opens the home at 390 and 1280 px in dark and light and fails on an unpainted icon, a
  zero-size glyph, or button text that is invisible against what is behind it.
• YouTube-shaped watch addresses (2026-11-07, the owner: "on openvibe.video we should copy the style of YouTube… /watch,
  and then like the actual video ID"). Every recording, clip and upload now has a short, stable, unguessable watch id —
  11 characters of URL-safe base64, minted once by OpenVibe.Media (one id space across VODs and clips) — and its page is
  /watch?v=<id> (with &t=<seconds> for a moment). The old /v/:id, /c/:id and /u/:id answer 301 to it, carrying
  the query over. An upload's id is copied from its Media VOD into video_uploads.watch_id (migration
  0024_watch_ids.sql: a nullable column and a partial unique index; rows written before it are backfilled in a batch at
  boot). Canonical links, JSON-LD, the share sheet, the sitemap, llms.txt, IndexNow, the Markdown twins, the menu card
  and every card built from data name the watch page. Tests: test/video-watch-ids.test.js (backfill once and distinct,
  old → 301 → new with t kept, canonical/share/sitemap/twin at /watch?v=).

• The drive has a bin, and the API has the drive's full controls (2026-11-07). Deleting a file — from its page, its
  card, or DELETE /api/v1/files/:id — puts it in the bin for 30 days instead of deleting it: its share links stop at
  once, its bytes stay in OpenVibe.Media, and it still counts against storage. /files/bin in the sidebar (with a
  count) lists what is there, each file with Restore and Delete forever, and an Empty the bin button; a file binned more
  than 30 days ago is purged hourly in batches of 200 (the row is soft-deleted and Media is asked for the object). The
  API now also takes PATCH /api/v1/files/:id (name, folder_id; null is the top), PATCH /api/v1/folders/:id
  (name), DELETE /api/v1/folders/:id (409 folder.not_empty), GET /api/v1/files?q= across every folder,
  POST /api/v1/files/:id/restore and DELETE /api/v1/files/:id?forever=1; a sync key may rename and move but may not
  delete a folder. Migration 0023_files_bin.sql.
• openvibe.download looks and works like a drive (2026-11-07, the owner: "a competitor to Google Drive … sleek and easy
  to use and intuitive and minimalist while being powerful … full controls"). /files is a sidebar (New, My files,
  Shared links, Backups, the storage meter) beside the files: folder tiles, then file cards with the picture or a
  coloured tile for the kind (PDF, document, spreadsheet, slides, archive, code, audio, video), or the same cards as
  rows in the list view. Search covers every folder (?q=, and it filters what is on screen as you type); sort by
  newest, oldest, name or size, remembered. Files dropped anywhere on the page upload into the folder on screen, many
  at once, with a tray that shows each one's progress and refreshes the list when they are in. Every file and folder
  has a menu: Download, Share a link, Move to…, Rename, Delete; a folder deletes only when it is empty. On a phone, New
  is a floating button that opens a bottom sheet, and a menu opens as a sheet over the tab bar.
  A file's page shows the file large beside what you can do with it: who can open a link (three choices, drawn as
  cards), expiry as chips, Move, Rename, the facts and Delete. Fixed on the way: a folder made inside a folder went to
  the top level. Everything still works with JavaScript off.
• Content labels show on openvibe.video and OpenVibe.Pics (2026-11-02, L1). Cards, watch pages and pictures say in
  words what they carry (Nudity, Strong language, 18+…), and each viewer's own choice on openvibe.network shows,
  blurs or hides them. A maker always sees their own; on a video's or picture's own page a hide covers it with a
  "Show" button rather than leaving the page empty. Owners set the labels in the edit forms: AI suggestions are
  marked and never ticked for them, and ticking nothing clears them. openvibe-shared 4.94.0.
• OpenVibe.Pics says in writing what it does with a picture (2026-10-30, the market research): three policy pages —
  /exif (the metadata — the GPS position, the camera, the time it was taken — is taken out by us, and the file you
  upload is not kept), /content-policy (what is not allowed, how a rule is enforced, and what this site does not
  do) and /ai-training (we do not train on the pictures you upload; the one thing that asks a model is the alt text
  you ask for, and it keeps a hash, not the picture). Every number on them comes from the service's own
  configuration, and where the code cannot promise something the page says so: the stripping happens after your file
  arrives, and a promise about AI is not a lock. The home says in one line who removes the metadata, and a picture's
  page shows its links side by side — the file itself, Markdown, BBCode and HTML — copyable without an account.

• The watch pages say what the video is (2026-10-30, the market research): under the title, the kind — a stream
  recording, a clip or an upload — with the day it was streamed (Live's own stream time), its length and its views.
  Every word comes from the item's own fields; a fact Live does not give is left out, not guessed. A clip credits the
  recording it was cut from and links back to it, at the moment the clip starts; a recording that is not public any
  more is named as such. The share box writes the page's own link out (a plain link, and ?t=125 to open the video at
  2:05 — a moment, not a clip: nothing is stored). Every export says what it is for (TXT to read, SRT for editors, VTT
  for web players, JSON for programs, CSV for spreadsheets) and the transcript says it was written by AI, and can be
  wrong. The menus on a phone open above the app bar, so their buttons are not behind it.

• openvibe.video's sitemap carries an image entry per video (SEO-17): the same entry that names <video:video> also names its thumbnail as <image:image><image:loc> — built from the thumbnail the video entry already has, so it is only there when the URL exists and is https. Entries without a thumbnail keep no image, the video entries and the ten-minute cache are unchanged, and openvibe.download's private shares and openvibe.pics (/i/ is in its robots' disallow) are untouched. test/video-pages.test.js pins one image per video entry, the same URL as its thumbnail_loc.
• openvibe.video's search basics (2026-10-20). A watch page nobody wrote about gets a description of its own (who,
  how long, when, its first words) instead of the site tagline. A recording under two minutes with nothing written
  about it is noindex and out of the sitemap: 118 of 785 were under a minute, mostly test streams. The sitemap lists
  every recording and clip (it stopped at 150 of each) with a video entry each (openvibe-shared 4.5.0) and is kept
  ten minutes. Structured data and the sitemap name Media's file with ?raw=1, since Media answers crawlers a page
  otherwise.
• MediaHub reaches OpenVibe.Media with its Network service token (audience openvibe.media, grants
  media.object.upload and media.object.read on namespace media-hub). MEDIAHUB_MEDIA_APP_KEY is gone
  (compatibility register C-71).
• OpenVibe.Video step A: openvibe.video now serves public, read-only watch pages for OpenVibe.Live's stream
  recordings and clips (/v/:id, /c/:id, /@:username, WebVTT captions and chapters), reading Live's public
  JSON API server-side, signed out. No uploads and no new storage.
• OpenVibe.Video step B: the VOD watch page now shows a chat replay of the stream (read from OpenVibe.Chat,
  oldest first, the first 1,000 messages) and read-only comments with the OpenVibe.Community thread link, plus the
  MEDIAHUB_CHAT_URL setting.
• OpenVibe.Video step C: playlists. Signed-in people can save recordings and clips into playlists (100 playlists per
  person, 500 items each), share them by link (public/unlisted), and watch them back with the ?list= up-next flow.
  Sign-in now works on the video host with its own callback URI, and the playlists are part of account export and
  deletion.
• openvibe.pics is still parked: its vhost answers 302 to https://openvibe.network/ and proxies nothing. The app
  no longer has "coming" pages or host-based brand handling.

0.1.0 — 2026-10-08

• openvibe.download v1, a private drive. Account-only uploads go into OpenVibe.Media: a plain form, or resumable
  parts. Files and folders are private, with per-person limits.
• Share links that expire, need a signed-in downloader and can name accounts (matched by subject; unknown names refused).
• Reports, suspension and a staff queue.
• Sandboxed attachment downloads.
• openvibe.pics and openvibe.video answer with honest "coming" pages.
• Account export and deletion (ADR-033) with openvibe-sdk/account-data.
• Pins: openvibe-contracts v0.118.0, openvibe-sdk v0.36.0, openvibe-shared v2.15.0.